Monitoring and testing in LTE networks: from experimental analysis to operational optimisation

(1)

Monitoring and testing in LTE networks:

from experimental analysis to

operational optimisation

Simone Roma

Department of Information Engineering

University of Pisa

This dissertation is submitted for the degree of

Doctor of Philosophy

(2)

(3)

(4)

(5)

Acknowledgements

Sono tante le persone che mi piacerebbe ringraziare, da coloro che mi hanno aiutato nella realizzazione della mia tesi a coloro che semplicemente mi hanno accompagnato durante la mia esperienza di dottorando.

Grazie a Gregorio e Christian. Non dimenticherò le innumerevoli discussioni, le giocate di regio quarto, le vie ferrate. Siete delle persone eccezionali, mi mancherete.

Grazie a Rosario e Stefano. Siete stati degli amici prima ancora che i miei tutor, sempre pronti a stimolare la mie curiosità e ad offrirmi un grande supporto.

Grazie a Simone. Sei stato diponibile con me fin dal primo istante, mi hai ospitato a casa tua incurante del fatto che sarei potuto essere un serial killer! Mi hai sostenuto e mi hai dato innumerevoli opportunità di crescita.

Grazie a Gianluca e a tutti gli amici del RadioLab. Calorosi e disponibili, ogni volta era un piacere tornare a Torino sapendo che vi avrei incontrato.

Grazie a Mihai, Carmen, Valentin, Christina e a tutti gli altri amici di Ixia, con cui ho condiviso 6 mesi splendidi a Bucharest (chi l’avrebbe mai detto!).

Grazie a Tiziano. Il Gemello. Dopo 8 anni passati sotto lo stesso tetto ci separiamo, purtroppo. Eppure non dimenticherò quanto fosse piacevole scambiare con te due parole la sera, quando tutti e due tornavamo a casa distrutti.

Grazie a Michele. Il Fratellone. Sei sempre stato generoso e i tuoi consigli sono sempre stati preziosi. I week end passati insieme mi riportavano indietro, a quando tutti e tre vivevamo insieme. Nostalgia canaglia!

Grazie a Serena. Soprattutto nell’ultimo anno hai dovuto sopportarmi anche come coinquilino, eppure sei sempre stata gentile e premurosa. Grazie a Laia. La tua allegria è contagiosa, riesci sempre a strapparmi un sorriso.

Grazie a Felice, mio ultimo compagno di mensa. Sei sempre stato disponibile con me. È sempre un piacere stare in tua compagnia, non sei mai banale.

Grazie a tutti gli amici pisani. Sono innumerevoli le belle serate che abbiamo passato insieme.

Grazie a mamma e papà. Grazie, grazie e ancora grazie. Senza di voi tutto questo non sarebbe mai stato possibile.

(6)

vi

Grazie a Giusy. Non potevo che lasciare te per ultima, per dare una degna conclusione a questi ringraziamenti. Non hai mai dubitato di me, sei stata il mio solido appoggio nei miei momenti di difficoltà. Quando avevo l’impressione di non andare nella direzione giusta tu mi hai ascoltato, mi hai consigliato e confortato. Sei la mia dolce metà, senza di te non so come farei.

(7)

Abstract

L’avvento di LTE e LTE-Adavanced, e la loro integrazione con le esistenti tecnologie cellulari, GSM e UMTS, ha costretto gli operatori di rete radiomobile ad eseguire una meticolosa campagna di test e a dotarsi del giusto know-how per rilevare potenziali problemi durante il dispiegamento di nuovi servizi. In questo nuovo scenario di rete, la caratterizzazione e il monitoraggio del traffico nonchè la configurazione e l’affidibilità degli apparati di rete, sono di importanza fondamentale al fine di prevenire possibili insidie durante la distribuzione di nuovi servizi e garantire la migliore esperienza utente possibile.

Sulla base di queste osservazioni, questa tesi di dottorato offre un percorso completo di studio che va da un’analisi sperimentale ad un’ottimizzazione operativa.

Il punto di partenza del nostro lavoro è stato il monitoraggio del traffico di un eNodeB di campo con tre celle, operativo nella banda 1800 MHz. Tramite campagne di misura successive, è stato possibile seguire l’evoluzione della rete 4G dagli albori del suo dispie-gamento nel 2012, fino alla sua completa maturazione nel 2015. I dati raccolti durante il primo anno, evidenziavano uno scarso utilizzo della rete LTE, dovuto essenzialmente alla limitata penetrazione dei nuovi smartphone 4G. Nel 2015, invece, abbiamo assistito ad un aumento netto e decisivo del numero di utenti che utilizzano la tecnolgia LTE, con statistiche aggregate (come gli indici di marketshare per i sistemi operativi degli smartphones, o la percentuale di traffico video) che rispecchiano i trend nazionali e internazionali. Questo importante risultato testimonia la maturità della tecnologia LTE, e ci permette di considerare il nostro eNodeB un punto di osservazione prezioso per l’analisi del traffico.

Di pari passo con l’evoluzione dell’infrastruttura, anche i telefoni cellulari hanno avuto una sorprendente evoluzione nel corso degli ultimi due decenni, a partire da dispositivi semplici con servizi di sola voce, fino agli smartphone di ultima generazione che offrono servizi innovativi, come Internet mobile, geolocalizzazione e mappe, servizi multimediali, e molti altri. Monitorare il traffico reale ci ha quindi permesso di studiare il comportamento degli utenti e individuare i servizi maggiormente utilizzati. Per questo, sono state sviluppate diverse librerie software per l’analisi del traffico. In particolare, è stato sviluppato in C++14 un framework/tool per la classificazione del traffico. Il progetto, disponibile su github, si chiama MOSEC, un acronimo per MOdular SErvice Classifier. MOSEC consente di definire

(8)

viii

e utilizzare un numero arbitrario di plug-in, che processano il pacchetto secondo le loro logiche e possono o no ritornare un valore di classificazione. Una strategia di decisione finale consente di classificare i vari flussi, basandosi sulle classificazioni di ciascun plug-in. Abbiamo quindi validato la bontà del processi di classificazione di MOSEC utilizzando una traccia labellata come ground-truth di classificazione. I risultati mostrano una eccellente capacità di classificazione di traffico TCP-HTTP/HTTPS, mediamente superiore a quella di altri tool di classificazione (nDPI, PACE, Layer-7), ed evidenzia alcune lacune per quanto riguarda la classificazione di traffico UDP.

Le carattistiche dei flussi di traffico utente (User Plane) hanno un impatto diretto sul consumo energetico dei terminali e indiretto sul traffico di controllo (Control Plane) che viene generato. Pertanto, la conoscenza delle proprietà statistiche dei vari flussi consente di affrontare un problema del cross-layer optimization, per ridurre il consumo energetico dei terminali variando dei parametri configurabili sugli eNodeB. E’ noto che la durata della batteria dei nuovi smartphone, rappresenta uno dei maggiori limiti nell’utilizzo degli stessi. In particolare, lo sviluppo di nuovi servizi e applicazioni capaci di lavorare in background, senza la diretta interazione dell’utente, ha introdotto nuovi problemi riguardanti la durata delle batterie degli smartphone e il traffico di segnalazione necessario ad acquisire/rilasciare le risorse radio. In conformità a queste osservazioni, è stato condotto uno studio approfondito sul meccanismo DRX (Discontinuous Reception), usato in LTE per consentire all’utente di risparmiare energia quando nessun pacchetto è inviato o ricevuto. I parametri DRX e RRC Inactivity Timer influenzano notevolmente l’energia consumata dai vari device. A seconda che le risorse radio siano assegnate o meno, l’UE si trova rispettivamente negli stati di RRC Connected e RRC Idle. Per valutare il consumo energetico degli smartphone, è stato sviluppato un algoritmo che associa un valore di potenza a ciascuno degli stati in cui l’UE può trovarsi. La transizione da uno stato all’altro è regolata da diversi timeout che sono resettati ogni volta che un pacchetto è inviato o ricevuto. Utilizzando le tracce di traffico reale, è stata associata una macchina a stati a ogni UE per valutare il consumo energetico sulla base dei pacchetti inviati e ricevuti. Osservando le caratteristiche statistiche del traffico User Plane è stata ripetuta la simulazione utilizzando dei valori dell’Inactivity Timer diversi da quello impiegato negli eNodeB di rete reale, alla ricerca di un buon trade-off tra risparmio energetico e aumento del traffico di segnalazione. I risultati hanno permesso di determinare che l’Inactivity Timer, settato originariamente sull’eNodeB era troppo elevato e determinava un consumo energetico eccesivo sui terminali. Diminuendone il valore fino a 10 secondi, si può ottenere un risparmio energetico fino al 50% (a secondo del traffico generato) senza aumentare considerevolemente il traffico di controllo.

(9)

ix

I risultati dello studio di cui sopra, tuttavia, non tengono in considerazione lo stato di stress cui può essere sottoposto un eNodeB per effetto dell’aumento del traffico di segnalazione, nè, tantomeno, dell’aumento della contesa di accesso alla rete durante la procedura di RACH, necessaria per ristabilire il bearer radio (o connessione RRC) tra terminale ed eNodeB.

Valutare le performance di sistemi hardware e software per la rete mobile di quarta generazione, cosi come individuare qualsiasi possibile debolezza all’interno dell’architettura, è un lavoro complesso. Un possibile caso di studio, è proprio quello di valutare la robustezza delle Base Station quando riceve molte richieste di connessioni RRC, per effetto di una diminuzione dell’Inactivity Timer. A tal proposito, all’interno del Testing LAB di Telecom Italia, abbiamo utilizzato IxLoad, un prodotto sviluppato da Ixia, come generatore di carico per testare la robustezza di un eNodeB. I test sono consistiti nel produrre un differente carico di richieste RRC sull’interfaccia radio, similmente a quelle che si avrebbero diminuendo l’Inactivity Timer. Le proprietà statistiche del traffico di controllo sono ricavate a partire dall’analisi dalle tracce di traffico reale. I risultati hanno dimostrato che, anche a fronte di un carico sostenuto di richieste RRC solo una minima parte (percentuale inferiore all’1% nel caso più sfavorevole) di procedure fallisce. Abbassare l’inactivity timer anche a valori inferiori ai 10 secondi non è quindi un problema per la Base Station.

Rimane da valutare, infine, cosa succede a seguito dell’aumento delle richieste di accesso al canale RACH, dal punto di vista degli utenti. Quando due o più utenti tentano, simultanea-mente, di accedere al canale RACH, utilizzando lo stesso preambolo, l’eNodeB potrebbe non essere in grado di decifrare il preambolo. Se i due segnali interferiscono costruttivamente, entrambi gli utenti riceveranno le stesse risorse per trasmettere il messaggio di RRC Request e, a questo punto, l’eNodeB può individuare la collisione e non trasmetterà nessun acknowl-edgement, forzando entrambi gli utenti a ricominciare la procedura dall’inizio. Abbiamo quindi proposto un modello analitico per calcolare la probabilità di collisione in funzione del numero di utenti e del carico di traffico offerto, quando i tempi d’interarrivo tra richieste successive é modellata con tempi iper-esponenziali. In più, abbiamo investigato le prestazioni di comunicazioni di tipo Machine-to-Machine (M2M) e Human-to-Human (H2H), valutando, al variare del numero di preamboli utilizzati, la probabilità di collisione su canale RACH, la probabilità di corretta trasmissione considerando sia il tempo di backoff che il numero massimo di ritrasmissioni consentite, e il tempo medio necessario per stabilire un canale radio con la rete di accesso. I risultati, valutati nel loro insieme, hanno consentito di esprimere delle linee guida per ripartire opportunamente il numero di preamboli tra comunicazioni M2M e H2H.

(10)

(11)

Abstract

The advent of LTE and LTE-Advanced, and their integration with existing cellular technolo-gies, GSM and UMTS, has forced the mobile radio network operators to perform meticulous tests and adopt the right know-how to detect potential new issues, before the activation of new services. In this new network scenario, traffic characterisation and monitoring as well as configuration and on-air reliability of network equipment, is of paramount relevance in order to prevent possible pitfalls during the deployment of new services and ensure the best possible user experience.

Based on this observation, this research project offers a comprehensive study that goes from experimental analysis to operational optimization. The starting point of our work has been monitoring the traffic of an already deployed eNodeB with three cells, operative in the 1800 MHz band. Through subsequent measurement campaigns, it was possible to follow the evolution of the 4G network by the beginning of its deployment in 2012, until its full maturity in 2015. The data collected during the first year, showed a poor use of the LTE network, mainly due to the limited penetration of new 4G smartphone. In 2015, however, we appreciate a clear and decisive increase in the number of terminals using LTE, with aggregate statistics (e.g. marketshare for smartphone operating systems, or the percentage of video traffic) that reflect the national trend. This important outcome testifies the maturity of LTE technology, and allows us to consider our monitored eNodeB as a valuable vantage point for traffic analysis.

Hand in hand with the evolution of the infrastructure, even mobile phones have had a surprising evolution over the past two decades, from simple devices with only voice services, towards smartphones offering novel services such as mobile Internet, geolocation and maps, multimedia services, and many more. Monitoring the real traffic has allowed us to study the users behavior and identify the services most used. To this aim, various software libraries for traffic analysis have been developed. In particular, we developed a C/C++ library that analyses Control Plane and User Plane traffic, which provides corse and fined-grained statistics at flow-level. Another framework/tool has been exclusively dedicated to the topic of traffic classification. Among the plethora of existing tool for traffic classification we provide our own solution, developed from scratch. The project, which is available on github, is

(12)

xii

named MOSEC, an acronym for Modular SErvice Classifier. The modularity is given by the possibility to implement multiple plug-ins, each one will process the packet according to its logic, and may or may not return a packet/flow classification. A final decision strategy allows to classify the various streams, based on the classifications of each plug-in. Despite previous approaches, the ability of keeping together multiple classifiers allows to mitigate the deficiency of each classifiers (e.g. DPI does not work when packets are encrypted or DNS queries don’t have to be sent if name resolution is cached in device memory) and exploit their full-capabilities when it is feasible. We validated the goodness of MOSEC using a labelled trace synthetically created by colleagues from UPC BarcelonaTech. The results show excellent TCP-HTTP/HTTPS traffic classification capabilities, higher, on average, than those of other classification tools (NDPI, PACE, Layer-7). On the other hand, there are some shortcomings with regard to the classification of UDP traffic.

The characteristics of User Plane traffic have a direct impact on the energy consumed by the handset devices, and an indirect impact on the Control Plane traffic that is generated. Therefore, the acquaintances of the statistical properties of the various flows, allows us to deal with the problem of cross-layer optimization, that is reducing the power consumption of the terminals by varying some control plane parameters configurable on the eNodeB. It is well known that the battery life of the new smartphones is one of the major limitations in the use of the same. In particular, the birth of new services and applications capable of working in the background without direct user interaction, introduced new issues related to the battery lifetime and the signaling traffic necessary to acquire/release the radio resources. Based on these observations, we conducted a thorough study on the DRX mechanism (Discontinuous Reception), exploited by LTE to save smartphones energy when no packet is sent or received. The DRX configuration set and the RRC Inactivity Timer greatly affect the energy consumed by the various devices. Depending on which radio resources are allocated or not, the user equipment is in the states of RRC Connected and Idle, respectively. To evaluate the energy consumption of smartphones, an algorithm simulates the transition between all the possible states in which an UE can be and maps a power value to each of these states. The transition from one state to another is governed by different timeouts that are reset every time a packet is sent or received. Using the traces of real traffic, we associate a state machine to each for assessing the energy consumption on the basis of the sent and received packets. We repeated these simulations using different values of the inactivity timer, that appear to be more suitable than the one currently configured on the monitored eNodeB, looking for a good trade-off between energy savings and increased signaling traffic. The results highlighted that the Inactivity Timer set originally sull’eNodeB was too high and determined an excessive energy consumption on the terminals. Reducing the value up to 10 seconds permits to achieve energy

(13)

xiii

savings of up to 50% (depending on the underling traffic profile) without up considerably the control traffic.

The results of the study mentioned above, however, do not consider neither the stress level which the eNodeB is subject to, given the raise of signaling traffic that could occur, nor the increase of collision probability during the RACH procedure, needed to re-establish the radio bearer (or RRC connection ) between the terminal and eNodeB .

Evaluate the performance of hardware and software systems for the fourth-generation mobile network, as well as identify any possible weakness in the architecture, it is a complex job. A possible case study, is precisely to assess the robustness of the base station when it receives many requests for RRC connections, as effect of a decrease of the inactivity timer. In this regard, within the Testing LAB of Telecom Italia, we used IxLoad, a product developed by Ixia, as a load generator to test the robustness of one eNodeB. The tests consisted in producing a different load of RRC request on the radio interface, similar to those that would be produced by decreasing the inactivity timer to certain values. The statistical properties for the signalling traffic are derived from the analysis of real traffic traces. The main outcomes have shown that, even in the face of an high load of RRC requests only a small part (less than 1% in the most unfavorable of the cases) of the procedure fails. Therefore, even lowering the inactivity timer at values lower than 10 seconds is not an issue for the Base Station.

Finally, remains to be evaluated how such surge of RRC request impacts on users performance. If one of the users under coverage in the RRC Idle is paged for an incoming packet or need to send an uplink packet a state transition from RRC Idle to RRC Connected is needed. At this point, the UE initiates the random access procedure by sending the random access channel preamble (RACH Preamble). When two or more users attempt, simultaneously, to access the RACH channel, using the same preamble, the eNodeB may not be able to decipher the preamble. If the two signals interfere constructively, both users receive the same resources for transmitting the RRC Request message and, at this point, the eNodeB can detect the collision and will not send any acknowledgment, forcing both users to restart the procedure from the beginning. We have proposed an analytical model to calculate the probability of a collision based on the number of users and the offered traffic load, when the interarrival time between requests is modeled with hyper-exponential times. In addition, we investigated some performance for Machine-to-Machine (M2M) and Human-to-Human (H2H) type communications, including the probability of correct transmission considering either the backoff time either the maximum number of allowed retransmissions, and the average time required to established a radio bearer with the access network. The results, considered as a whole, have made possible to express the guidelines to properly distribute the number of preambles in H2H and M2M communications.

(14)

(15)

List of figures

1.1 LTE Architecture . . . 5

1.2 EPS Bearer . . . 6

1.3 Uu Interface protocol stack: User Plane . . . 7

1.4 Uu Interface protocol stack: Control Plane . . . 7

1.5 S1 interface protocol stack: Control Plane . . . 8

1.6 S1 interface protocol stack: User Plane . . . 9

1.7 LTE Channel Mapping: Downlink (left) and Uplink (right) . . . 10

2.1 Average UE number in each day . . . 22

2.2 Operating System Market Share from selected vantage point . . . 23

2.3 Application Analyisis: Flow Percentage . . . 25

2.4 Application Analyisis: Aggregate Data . . . 26

2.5 Number of video flow . . . 27

2.6 Video data . . . 28 2.7 Working Day 2014 . . . 29 2.8 Working Day 2015 . . . 30 2.9 WeekEnd 2014 . . . 31 2.10 WeekEnd 2015 . . . 31 2.11 MOSEC: Buffer . . . 34

2.12 MOSEC: Decoding Process at Layar 4 . . . 35

2.13 MOSEC: Flow Inforamtion Structure . . . 36

2.14 MOSEC: Classification Process . . . 36

2.15 MOSEC: Debug Plug-in . . . 37

2.16 MOSEC: Framework Design . . . 38

2.17 MOSEC: Port Plug-in . . . 40

2.18 MOSEC: DNS Plug-in . . . 42

2.19 MOSEC: SSL Plug-in . . . 44

(20)

xx List of figures

2.21 MOSEC: Per-Classifier Statistics (1) . . . 47

2.22 MOSEC: Per-Classifier Statistics (2) . . . 49

2.23 UPC: Application Protocol . . . 51

2.24 UPC: Application . . . 51

2.25 UPC: Web Service . . . 52

3.1 The RRC state machine . . . 71

3.2 RRC Inactivity Timer . . . 74

3.3 id-Cause analysis for RRC Connections released before 61 seconds . . . 75

3.4 Flow Message for paged UE . . . 76

3.5 LTE Promotion Time for paged UE . . . 77

3.6 Network Overhead . . . 78

3.7 Maximum Gap: CDF and Histogrm . . . 81

3.8 Rvalue : CDF . . . 82

3.9 Maximum Gap for considered applications: CDF and Histogram . . . 83

3.10 R value for considered applications: CDF . . . 84

3.11 Energy Consumed vs Throughput . . . 85

3.12 Per-UE consumed energy, normalized to the reference value . . . 86

3.13 Per-UE umber of RRC connection procedures, normalized to the reference value . . . 86

3.14 Overall number of RRC connection procedures, normalized to the reference value . . . 87

4.1 Rate for RRCIT = 70.554s . . . 91

4.2 Rate for RRCIT = 12.154s . . . 92

4.3 Rate for RRCIT = 2.134s . . . 93

4.4 Log file (.dct) for IxLoad . . . 95

4.5 Latency for RRCIT = 70.544s (left) and 2.035s (rigth) - 100 UEs . . . 98

4.6 Rate for RRCIT = 70.544s (left) and 2.035s (rigth) - 100 UEs . . . 98

4.7 Latency for different Inactivity Timer value - 100 UEs . . . 99

4.8 Latency for different Inactivity Timer value - 400 UEs . . . 100

4.9 Maximum number of DCI in one seconds (up) and average number of DCI per TTI (down) . . . 102

4.10 Impact on UP throughput for RRCIT = 2.035s - 400 UEs . . . 103

4.11 RRC Connection Setup/Release Sequence - Table 5.2.1-1 [7] . . . 105

4.12 MAC sub-header for Backoff Indicator . . . 112

(21)

List of figures xxi

4.14 BIC vs C for RRCIT = 2, 5, 10s (Left to Right) . . . 114

4.15 QQplot for Inactivity Timer = 2,5,10 (Left to Right) . . . 115

4.16 Switching analogue to RACH request operations . . . 115

4.17 RACH requests arrival process . . . 117

4.18 Analytical model vs. simulation results - P_C(HTC)and the P_C(RAO)for different RACHP values, k . . . 119

4.19 Pc(MTC) for different PrachConfigIndex - Pc(MTC)is defined in AnnexB of [8] 122 4.20 Pc(RAO) for different PrachConfigIndex - Pc(RAO)is defined in Section 6.3 of [8]123 4.21 Pc(MTC) evaluated with λ2= 10 (upper curves) and λ1= 100 (lower curves) 124 4.22 Success Probability with λ2= 10 (left) and λ1= 100 (rigth) . . . 125

4.23 Transmission Delay (from the 1st attempt to the successfull one), with λ1= 100 (left) and λ2= 10 (rigth) . . . 126

4.24 Average maximum number of attempts per UE, with λ2= 10 (left) and λ1= 100 (rigth) . . . 126

4.25 Pc(HTC)evaluated with RRCIT = 2s, RRCIT = 5s and RRCIT = 10s . . . 127

4.26 Success Probability for HTC evaluated with RRCIT = 2s (left), RRCIT = 5s (center) and RRCIT = 10s () rigth . . . 127

4.27 Transmission delay for HTC, evaluated with RRCIT = 2s (left), RRCIT = 5s (center) and RRCIT = 10s () rigth . . . 128

(22)

(23)

List of tables

1.1 LTE and LTE Advanced Requirements . . . 3 1.2 UE category and capabilities . . . 4 2.1 Measurement Session: Overall Statistics . . . 21 3.1 Protocol Analysis . . . 79 3.2 HTTP Protocol Analysis . . . 81 3.3 Power Model Parameters . . . 84 4.1 Stats for different RRCIT . . . 92

4.2 RACH Procedure Configuration . . . 96 4.3 Test Results with 100 UE . . . 97 4.4 Test Results with 400 UEs . . . 100 4.5 IRRi: Statistical Parameters . . . 113

(24)

(25)

Nomenclature

Roman Symbols

3GPP 3rd Generation Partnership Program

ARQ Automatic Repeat Request

AWS Amazon Web Services

BCH Broadcast Channel

BSC Base Station Controller

CAGR Compound Annual Growth Rate

CCCH Common Control Channel

CFI Control Format Indicators

CP Control Plane

CQI Channel Quality Indicators

CS Circuited Switched

CSFB CS Fall Back

DCCH Dedicated Control Channel

DCI Downlink Control Information

DL Downlink

DL-SCH Downlink Shared Channel

(26)

xxvi Nomenclature

DNS Domain Name Server

DPI Deep Packet Inspection

DRX Discontinuous Reception

DSCP Differentiated Service Code Point DTCH Dedicated Traffic Channel

E-RAB E-UTRAN Radio Access Bearer

E-UTRAN Evolved UTRAN

eNodeB evolved NodeB

EPC Evolved Packet Core

EPS Evolved Packet System

GBR Guaranteed Bit Rate

GPRS General Packet Radio Service

GSM Global System for Mobile communications

GTP GPRS Tunneling Protocol

HARQ Hybrid ARQ

HSPA High-Speed Packet Access

HSS Home Subscriber Server

IMEI International Mobile Station Equipment Identity IMSI International mobile subscriber identity

IP Internet Protocol

(27)

Nomenclature xxvii

LTE Long Term Evolution

LTE-A Long Term Evolution Advanced

MBMS Multimedia Broadcast Multicast Service

MBSFN Multicase Broadcast Single Frequency Network MCCH Multicast Control Channel

MIB Master Information Block

MIMO Multiple Input Multiple Output

MME Mobility Management Entity

MOSEC MOdular SErvice Classifier MTCH Multicast Traffic Channel

OFDM Orthogonal Frequency-Division Multiplexing

OTT Over The Top

P-GW PDN Gateway

PBCH Physical Broadcast Channel

PCC Policy and Charging Control

PCFICH Physical Control Format Indicator Channel PCRF Policy and Charging Resource Function PDCCH Physical Downlink Control Channel PDCP Packet Data Convergence Protocol

PDN Packet Data Network

PDN-GW PDN Gateway

PDSCH Physical Downlink Shared Channel PHICH Physical Hybrid ARQ Indicator Channel PMCH Physical Multicast Channel

(28)

xxviii Nomenclature

PRACH Physical Random Access Channel PUCCH Physical Uplink Control Channel PUSCH Physical Uplink Shared Channel

QoS Quality of Service

RAN Radio Access Network

RAT Radio Access Technology

RI Rank Indicators

RLC Radio Link Control

RNC Radio Network Controller

RNTI Radio Network Temporary Identifier

RoCH Robust Header Compression

RRC Radio Resource Control

RRM Radio Resource Management

S-GW Serving Gateway

SCTP Stream Control Transmission Protocol

SIB System Information Block

SM Spatial Multiplexing

SR Scheduling Request

SRB Signalling Radio Bearer

TAC Type Approval code

TILAB Telcom Italia LAB

TIM Telecom Italia Mobile

TMSI Temporary Mobile Subscriber Identify

(29)

Nomenclature xxix

UL Uplink

UL-SCH Uplink Shared Channel

(30)

(31)

Chapter 1 Motivation and Scope

1.1 Motivation and Scope

The evolution and growth of mobile network is fundamentally changing the way users access the Internet and consume content and services. Mobile phones have had a surprising evolution over the last two decades, starting from simple devices with only voice services towards smartphones offering novel services such as mobile Internet, geolocation and maps, multimedia services, and many more. To fulfil the demand for high data rate and meet user expectation a new wireless interface is introduced in mobile networks as part of the fourth cellular network generation (4G).

Indeed, according to Cisco Visual Networking Index (VNI), globally, mobile data traffic will increase 10-fold between 2014 and 2019. Mobile data traffic will grow at a Compound Annual Growth Rate (CAGR) of 57 percent between 2014 and 2019, reaching 24.2 exabytes per month by 2019, and three time faster than fixed IP traffic in the same range period. Global mobile data traffic was 4 percent of total IP traffic in 2014, and will be 14 percent of total IP traffic by 2019. Furthermore, by 20191:

i. there will be 5.2 billion global mobile users, up from 4.3 billion in 2014

ii. there will be 11.5 billion mobile-ready devices and connections, more than 4 billion more than there were in 2014

iii. the average mobile connection speed will increase 2.4-fold, from 1.7 Mbps in 2014 to 4.0 Mbps by 2019

1

(32)

2 Motivation and Scope

iv. global mobile IP traffic will reach an annual run rate of 292 exabytes, up from 30 exabytes in 2014

The increase of traffic (and services), together with the growth of users expectations and the exponential growth of network complexity, require that telecommunication operators incorporate the right know-how and the right equipment to perform an effective and efficient testing for ensuring proper placement on field of the new technologies, and for evaluating their reliability in particular situations, remarkably in high load conditions. LTE technology needs extensive studies aimed at experimentally understanding how network resources are utilised by real users in a deployed commercial network setting.

1.2 LTE and LTE-Advanced: Fundamentals

Long Term Evolution (LTE) starts from release 8, standardised by the 3rd Generation Partnership Program (3GPP) as the successor of the Universal Mobile Telecommunication System (UMTS) standard. 3GPP Technical Report 25.913 defines the key objectives of LTE as:

i. support of a flexible bandwidth up to 20 MHs,

ii. peak downlink rate of 100 Mbps when using two receiving antennas at the user equipment,

iii. peak uplink rate when using 1 transmitting antenna at the user equipment, iv. round trip time less than 10 ms on the air interface,

v. improve downlink and uplink spectrum efficiency

LTE was designed and optimised with the assumption that all of the services would be packet-switched rather than circuit switched, thus continuing the trend set from the evolution of Global System for Mobile communications (GSM), to General Packet Radio Service (GPRS), Enhanced Data Rates for GSM Evolution (EDGE), UMTS, and High-Speed Packet Access (HSPA). Nevertheless, it still includes functionality to handle Circuited Switched (CS), e.g. CS Fall Back (CSFB) to UMTS or GSM.

LTE Advanced (LTE-A) is an evolved version of LTE with increased capabilities and improved performance. It starts from 3GPP release 10 and introduces Carrier Aggregation to provide wider effective channel bandwidths. It also introduces MIMO in the uplink direction, as well as increasing the number ot antenna elements that can can be exploited for MIMO in downlink direction.

(33)

1.2 LTE and LTE-Advanced: Fundamentals 3 Table 1.1 LTE and LTE Advanced Requirements

LTE-A LTE

Requirements Requirements

Peak Throughput Uplink 500 Mbps 50 Mbps

Downlink 1 Gbps 100 Mbps

Peak Spectrum Efficiency Uplink 15 bps/Hz 2.5 bps/Hz

Downlink 30 bps/Hz 5.0 bps/Hz

Control Plane Latency From Idle 50 ms 100 ms

From Connected (DRX) 10 ms 50 ms

User Plane Latency < 5 ms < 5 ms

Table 1.1 compares some of the key requirements for LTE and LTE-Advanced, specified in TR 25.913 and 36.913 respectively.

Peak throughput requirements for LTE Advanced are 10 times greater then those for LTE. These improvements are fundamentally achieved using a combination of increased bandwidth and increased multiple antenna transmission capability. Indeed, the maximum 20 Mhz bandwidth in LTE, can be increased up to 100 MHz, and 4x4 MIMO in LTE evolves to 8x8 MIMO (even if the assumption of 100 Mbps in LTE is reached with 2x2 MIMO). Peak spectrum efficiency requirements for LTE-A are 6 times larger than in LTE. Spectrum efficiency is a measure of throughput per unit of bandwidth: thus increasing throughput while increasing the available bandwidth, does not provide an higher spectrum efficiency. The improvement shown in the table primarily resides in MIMO techniques. Control plane latencies represent the delay in moving the UE into a state where it is ready to transfer data with user plane connection. The user plane latencies represents the one-way delay between the IP layer in the UE and IP layer in the eNodeB. This value is strictly related to HARQ process the regulates transmission on the air interface on both side.

Regardless of the network capabilities, the system is nevertheless constrained by the actual capabilities of the receiver mobile equipment. That is, the UE capabilities. LTE defines five UE radio capability categories, to which a given UE has to conform to. These range from a UE not capable of MIMO transmission with a maximum throughput of 10 Mbit/s DL and 5 Mbit/s UL to a 4×4-capable MIMO terminal with up to 300 Mbit/s DL and 70 Mbit/s UL. Table 2.2 details the maximum throughput for both DL and UL, as well as their MIMO Spatial Multiplexing (SM) capabilities.

(34)

4 Motivation and Scope Table 1.2 UE category and capabilities

1.2.1 LTE Architecture

The Evolved Packet System (EPS) architecture is shown in Figure 1.1. It is organised in four groups: User Equipment (UE), Evolved UTRAN (E-UTRAN), Evolved Packet Core (EPC) and Services. In order to minimise end-to-end latency, the number of network elements was reduced compared to 2G and 3G, resulting in the so-called “flat architecture”. UEs are connected with eNodesB that provides all radio interface-related functions. In contrast to prior architectures, the LTE Radio Access Network (RAN) is a meshed network where the functions previously fulfilled by the Radio Network Controller (RNC) in UMTS and/or the Base Station Controller (BSC) in GSM are integrated into the eNodeB. In order to enable a meshed RAN topology, the eNodeBs are now not only hierarchically connected to the core network but are also able to communicate with each other, which makes it potentially possible to employ eNodeB cooperation schemes to increase network performance. eNodeBs implements the following RAN functionalities:

• All PHY and MAC layer procedures, including link adaptation, Hybrid Automatic Repeat reQuest (HARQ), and cell search

• Radio Link Control (RLC): Segmentation and Automatic Repeat reQuest (ARQ) control of the radio bearers

• Packet Data Convergence Protocol (PDCP): IP header compression by means of Robust Header Compression (RoHC) and encryption of the user data streams.

(35)

1.2 LTE and LTE-Advanced: Fundamentals 5

• Radio Resource Control (RRC): at the C-Plane level, it controls the handover, manages Quality of Service (QoS), establishes and maintains radio bearers, manages keys (security), and controls/reports UE measurements.

• Radio Resource Management (RRM): ensures that radio resources are assigned effi-ciently and meeting the QoS constraints imposed by the core network. The RRM layer achieves it by means of controlling radio admission and bearers, connection mobility, and UL/DL scheduling.

• Selection of a Mobility Management Entity (MME) at UE attachment. • Routing of the U-Plane data towards the Serving Gateway (S-GW).

Fig. 1.1 LTE Architecture

The MME manages mobility and is used for all control plane procedures. The MME controls the access to EPC, i.e. it is responsible for attach and tracking procedure, for activation and deactivation of the bearers and for the choice of the S-GW during the initial attach procedure. It is also in charge for ciphering and integrity protection of Non-Access Stratum (NAS) signalling and for the distribution of paging messages to the eNodeB in the same tracking area.

S-GW forwards data packets, and serves as anchor for the user plane during inter-eNodeB and inter-RAT (Radio Access Technology) handovers. It manages and stores UEs contexts, like IP-related information or network internal routing information. Data packets are forwarded from eNodeB towards S-GW over a GPRS Tunneling Protocol (GTP) tunnel. Likewise, S-GW tunnels traffic to the Packet Data Network Gateway (PDN-GW).

(36)

Fig. 1.2 EPS Bearer

PDN-GW, or simply P-GW, offers connectivity towards Internet and other cellular data networks. This network element represents the input/output point for UE traffic, and can block all unwanted traffic like a firewall. P-GW enforces quality of service policies and provides packet filtering and monitoring to perform billing.

Policy and Charging Resource Function (PCRF) is the network element that is responsible for Policy and Charging Control (PCC). PCRF is a server usually located with other CN elements.

EPS uses the concept of EPS bearers to route IP traffic from a gateway in the PDN to the UE. A bearer is an IP packet flow with a defined quality of service (QoS) between the gateway and the UE. The EPS bearer model is shown in Figure 1.2. The E-UTRAN and EPC together set up and release bearers as required by applications. As part of the procedure by which a UE attaches to the network, the P-GW assigns an IP address to the UE, and at least one bearer, denoted as default bearer, is established. The default bearer remains established throughout the lifetime of the PDN connection in order to provide the UE with always-on IP connectivity to that PDN. The initial bearer-level QoS parameter values of the default bearer are assigned by the MME, based on subscription data retrieved from the HSS. Other EPS bearer can be established to connect to other PDN Gateways, or to provide different QoS to the same PDN Gateway. These bearers are known as dedicated bearers, which can be either a (Guaranteed Bit Rate) GBR or a non-GBR bearer (the default bearer always has to be a non-GBR bearer, since it is permanently established). An EPS bearer is generated form the combination of E-UTRAN Radio Access Bearer (E-RAB) and S5/S8 Bearer. The S5 interface provides connectivity between the S-GW and PGW, whereas the S8 interface provides roaming connectivity for the same entities. An E-RAB bearer in turn, is composed from a combination of the Radio Bearer, which provides the connection across the radio

(37)

interface and S1 Bearer, which is established at transport network level. Further details about bearer can be found in 3GPP TS 36.300.

1.2.2 LTE Interfaces and Protocol Stacks

This work involves the study of different E-UTRAN devices and interfaces. Among all the network device shown in figure 1.1, we focused our investigation on the eNodeB and all related interface. Therefore, is worth providing further details about the air-interface and the S1 interface.

Fig. 1.3 Uu Interface protocol stack: User Plane

The air-interface connection between the UE and eNodeB is known as Uu. The radio protocol architecture of E-UTRAN is given for the user plane and the control plane. Figure 1.3 (figure 4.3.1 at 3GPP TS 36.300 version 8.12.0 Release 8) shows the protocol stack for the user-plane, where PDCP, RLC and MAC sublayers (terminated in eNodeB on the network side) perform the functions listed for the user plane in subclause 6 of 3GPP TS 36.300, e.g. header compression, ciphering, scheduling, ARQ and HARQ.

Figure 1.4 shows the protocol stack for the control-plane, where the PDCP sublayer performs the functions listed for the control plane in subclause 6 for TS 36.300, e.g. ciphering

(38)

and integrity protection and RLC and MAC sublayers (terminated in eNB on the network side) perform the same functions as for the user plane. The main services and functions handled by the RRC sublayer include

• the broadcast of System Information related to Non-Access Stratum (NAS) and Access-Stratum (AS), where the terminating points are the MME and eNodeB respectively • establishment, maintenance and release of an RRC connection between the UE and

E-UTRAN

• security functions including key management;

• establishment, configuration, maintenance and release of point to point Radio Bearers; • mobility functions

• UE measurement reporting and control;

Fig. 1.5 S1 interface protocol stack: Control Plane

As for the air-interface, the S1 interface is given for the user plane, named S1-U, and the control plane, named S1-MME. From a logical standpoint, the S1-MME is a point-to-point interface between an eNodeB within the E-UTRAN and an MME in the EPC. A point-to-point logical interface should be feasible even in the absence of a physical direct connection between the eNodeB and MME. The S1-MME interface supports:

• procedures to establish, maintain and release E-UTRAN Radio Access Bearers; • procedures to perform intra-LTE handover and inter-RAT handover;

(39)

• the transfer of NAS signalling messages between UE and EPC;

• location services by transferring requests from the EPC to E-UTRAN, and location information from E-UTRAN to EPC;

S1-MME interface consists of a Stream Control Transmission Protocol (SCTP) over IP and supports multiple UEs through a single SCTP association. It also provides guaranteed data delivery. SCTP is defined in RFC 4960. The application signaling protocol is an S1-AP (Application Protocol). LTE Transport network layer is built on IP transport, similar to the user plane but for the reliable transport of signaling messages, SCTP is added on top of the Internet Protocol.

Fig. 1.6 S1 interface protocol stack: User Plane

The S1 user plane external interface (S1-U) is defined between the LTE eNodeB and the LTE S-GW. The S1-U interface provides non guaranteed data delivery of LTE user plane Protocol Data Units (PDUs) between the eNodeB and the S-GW. Transport network layer is built on IP transport and GTP-U. UDP/IP carries the user plane PDUs between the eNodeB and the S-GW. A GTP tunnel per radio bearer carries user traffic.

The S1-UP interface is responsible for delivering user data between the eNodeB and the S-GW. The IP Differentiated Service Code Point (DSCP) marking is supported for QoS per radio bearer.

1.2.3 LTE Channels

Within this thesis, we’ll make reference to different LTE channels. Instead of googling it, here we provide the whole picture for LTE channels, both for uplink and downlink.

(40)

Fig. 1.7 LTE Channel Mapping: Downlink (left) and Uplink (right)

Logical channels define what type of data is transferred. These channels define the data-transfer services offered by the MAC layer. Data and signalling messages are carried on logical channels between the RLC and MAC protocols. Logical channels can be divided into control channels and traffic channels. Control channel can be either common channel or dedicated channel: common channel means common to all users in a cell (Point to multipoint) while dedicated channels means channels can be used only by one user (Point to Point).

Transport channels define how and with what characteristics the data is transferred by the physical layer. Data and signalling messages are carried on transport channels between the MAC and the physical layer.

Data and signalling messages are carried on physical channels between the different levels of the physical layer and accordingly they are divided into Physical Data Channels, comprising the Physical Downlink and Uplink Shared Channel (PDSCH, PUSCH), the Phys-ical Broadcast Channel (PBCH), the PhysPhys-ical Multicast Channel (PMCH), PhysPhys-ical Random Access Channel (PRACH) and Physical Control Channels, comprising the Physical Control Format Indicator Channel (PCFICH), Physical Hybrid ARQ Indicator Channel (PHICH), the Physical Downlink and Uplink Control Channel (PDCCH, PUCCH). Physical data channels are distinguished by the ways in which the physical channel processor manipulates them, and by the ways in which they are mapped onto the symbols and sub-carriers used by Orthogo-nal Frequency-Division Multiplexing (OFDM). The transport channel processor composes several types of control information, to support the low-level operation of the physical layer.

The BCCH is used to transfer the Master Information Block (MIB) and the System Information Blocks (SIB). The MIB is then mapped to the BCH and PBC, whereas the SIB are mapped to DL-SCH and PDSCH. THe CCCH and DCCH are used to transfer RRC signalling,i.e. data belonging to the set of Signalling Radio Bearer (SRB). All SRB are mapped onto the DL-SCH (UL-SCH) and PDSCH (PUSCH). Application data are delivered through the Dedicated Traffic Channel (DTCH), the DL-SCH (UL-SCH) and PDSCH (PUSCH). For uplink data Uplink Control Information (UCI) can be added to the data from the UL-SCH during physical channel layer processing. This allows UCI to

(41)

1.3 Thesis Structure 11

transferred using the PUSCH when there is RRC signalling or application data to send. Application data belonging to the MBMS service are delivered through the MTCH, whereas the MCCH transfers the MBSFN area configuration message.

The PDDCH, PHICH and PCFICH are not used to transfer higher level layer information, so don’t have associated logical or transport channels. The PDDCH is used to transfer Down-link control information (DCI). Further details on DCI and PDDCH con be found in Chapter 4 and Annex A. The PHICH transfers HARQ Indicators, such as the acknowledgements for uplink data and the PCFICH transfers Control Format Indicators (CFI), which specifies how many OFDMA symbols will be used to allocate the PDDCH.

When a UE receives data on PDDSCH, the PDDCH indicates whether the data belongs to the DL-SCH or the PCH. This is done by using specific Radio Network Temporary Identifier (RNTI). For example the P-RNTI indicates PCH data whereas the C-RNTI and SI-RNTI indicates DL-SCH data. From DL-SCH messages are dispatched exploiting MAC header Logical Channel Identity (LCID) where a value of 0 correspond to the CCCH (SRB0) values of 1 and 2 correspond to the DCCH (SRB1 and SRB2 respectively) and values 3 to 10 correspond to DTCH.

In the uplink chain, the PUCCH is used to transfer the UCI. As part of the information carried in the UCI we remark the precence of the Channel Quality Indicators (CQI), Rank Indicators (RI), HARQ acknowledgments and Scheduling Request (SR). The PRACH is associated to RACH transport channel but this transport channel is only used to transfer random access preamble control information from the MAC layer to the Physical layer. We’ll talk exhaustively about the RACH procedure in Chapter 4.

1.3 Thesis Structure

The main sections of this thesis, which span Chapters 2 to 4, regard three different topics: i) passive monitoring and analysis of LTE live traffic ii) practical approach to optimise LTE network and extend battery life time of handset devices, iii) impact of network parameters on RRC/RACH eNodeB performance. A short summary of each of the core sections of this thesis, as well as their relationship, can be found in the subsections below.

1.3.1 Why Traffic Analysis

The advent of LTE and its integration with the existent cellular technologies (GSM, UMTS), forced network operators to perform a deep experimental analysis carried out with complex test-beds to discover possible new issues, before the activation of new services.

(42)

In this new network scenario, traffic characterisation and monitoring is of paramount relevance in order to prevent possible pitfalls during the deployment of new services.

We present the main issues evidenced by the test activity carried out in TILAB. Telecom Italia Mobile (TIM) is the major mobile operator in Italy. Thus, the selected lesson learned can be easily extended and generalised to other mobile operators with their own network infrastructures. The analysis considers the issues encountered during either the tests of new devices and network elements in the LTE test-bed of TILAB, or the usual maintenance and management tasks of TIM network.

This chapter reports on traffic measurements carried out at an LTE eNodeB, located in a business area of Turin. We show the evolution and the growth of the amount of LTE traffic and subscribers across three year.

Traffic analysis has been performed either by means of commercial monitoring system currently available in Telecom Italia, either by means of hand-crafted solution. In particular we developed a C/C++ software framework that analyses CP and UP traffic, which provides corse and fined-grained statistics at flow-level. The main outcome of this investigation becomes the input for the study of energy related issues, as it will be explained in Chapter 3.

Another framework has been exclusively dedicated to the topic of traffic classification. Among the plethora of existing tool for traffic classification we provide our own, developed from scratch, solution. The framework is named MOSEC, which enables modular packet classification. The modularity is given by the possibility to implement multiple plug-ins, each one will "suggest" its own packet/flow classification. Despite previous approaches, the ability of keeping together multiple classifiers allows to mitigate the deficiency of each classifiers (e.g. DPI does not work when packets are encrypted or DNS queries don’t have to be sent if name resolution is cached in device memory) and exploit their full-capabilities when it is feasible.

1.3.2 UE Power Saving in LTE

The spread of mobile Internet access introduces new energy-related issues to consider. From the network side, the eNodeB is the main energy hungry element of the radio access network. Most of the power consumed by the eNodeB is due to the base band unit, the power amplifier and the cooling system. Many studies have been focused on the design of techniques for reducing power consumption in the radio access network. These studies consider strategies for the energy-efficient resource allocation, for the carrier aggregation or for switching on/off network elements depending on their load.

From the users side, the battery lifetime represents the main limitation on smartphone usage. To achieve high data rates, higher order modulations (e.g. 64-QAM), advanced coding

(43)

1.3 Thesis Structure 13

and antenna techniques must be used. As a result, newer smartphones need complex circuitry that quickly consumes User Equipment (UE) battery. To cope with this issue, LTE employs different mechanisms to save energy.

This chapter enlightens the Discontinuous Reception (DRX) mechanism that allows UE to power down most of its circuitry when no data needs to be sent/received, and the role of the inactivity timer, which rules the shifting between the possible UE states.

We present our algorithm to estimate the energy consumed by a generic handset device. The algorithm represents an emulator of the underlying UE state machine. It accepts as input one packet with the associated timestamp and the average monitored throughput, and return the accumulated value of the consumed energy.

We test the impact of the RRCIT on the energy consumed by the UE and on the generated

signalling load.

The configuration set of the algorithm is exhaustively explained and the results provide an heuristic and a practical approach to optimise LTE network and extend device battery lifetime.

1.3.3 eNodeB performance

The main outcome of Chapter 3 is that decreasing too much the RRCIT leads to high control

plane traffic load to eNodeB. Therefore, the drawback is that the eNodeB could be stressed by a large number of RACH/RRC request if the UE under coverage are paged for an incoming packet or need to send an uplink packet.

First of all we focus on the RACH collision probability experienced by the UEs. To this aim, we propose a model to analytically derive the RACH collision probability starting from the inter-arrival times of RACH requests produced by a generic UE. To obtain this result, as already done for energy consumption estimation, we emulate the RRC state machine taking into account real traffic acquired at a commercial eNodeB. Several emulation sessions have been carried out according to different settings of the RRCIT. The output of the emulator

allows to reconstruct the time-series associated with the inter-arrival times of RACH requests produced by the average UE. Mixture modelling is then applied to such time-series and used to analytically estimate the RACH collision probability.

We proof the goodness of the model, simulating the scenario in which a large variable number of handset device exists and performs RACH request either generating hyper expo-nential inter-arrival times or directly using the inter-arrival obtained by parsing the real data set.

(44)

• MTC/RAO collision probability. We carried out several simulations, under different hypothesis, and evaluate the collision probability considering both the backoff indicator scheme and the time elapsed in connected by the device

• HTC (Human Type Communication) collision probability. We inferred statistical properties from live traffic and modeled user access requests using Mixture Modeling techniques.

• H2H impact on MTC performance. Given actual traffic statistics, the collision proba-bility has been evaluated if M2M and H2H communication share the same resource, without exploiting Access Class Barring (ACB) functionality.

Then, to evaluate the robustness of the eNodeB against burst of RRC connection requests, we set up a test using the Ixia load generator, IxLoad. According to the RRCIT set on the

eNodeB, we change the rate with which the RRC requests are randomly generated by the UEs camped on the base station. Again, the estimation of the RRC rate has been made looking at real traffic capture. To appreciate how much the control plane load affects the capabilities of the eNodeB we decide to measure the latency and the number of failures when establishing the RRC connection.

(45)

Chapter 2 Traffic Analysis

2.1 Introduction

As we already pointed out, globally mobile data traffic will increase 10-fold between 2014 and 2019. By 20191: there will be 5.2 billion global mobile users, up from 4.3 billion in 2014, 11.5 billion mobile-ready devices and connections, more than 4 billion more than there were in 2014 and the average mobile connection speed will increase 2.4-fold, from 1.7 Mbps in 2014 to 4.0 Mbps by 2019.

In Italy, after three years of its initial deployment in the major Italian cities, 4G coverages roughly the 80% of the whole country, serving more than three thousand cities, while LTE-A has already been deployed in more than 100 cities2.

As much the network complexity and application/traffic diversity degree arises, as well the expertise of network operators has to evolve to handle new or consolidate Over-The-Top (OTT) services. OTT services refers to delivery of audio, video, messaging and other media over the Internet without the involvement of a multiple-system operator in the control or distribution of the content. The Internet provider may be aware of the contents of the Internet Protocol packets but is not responsible for, nor able to control, the viewing abilities, copyrights, and/or other redistribution of the content. OTT in particular refers to content that arrives from a third party. The advent of such new services may be disruptive for consolidated business model and forces network operators to pursue new strategies and business opportunities. As an example, third parties provides instant messaging services as an alternative to text messaging services provided by a mobile network operator. Particularly WhatsApp narrowly focused to replace text messaging on internet connected smartphones.

1_{http://www.cisco.com/c/en/us/solutions/service-provider/}

visual-networking-index-vni/index.html#∼vniforecast

(46)

16 Traffic Analysis

The ability to intercept new trends has become essential for network operators. Thus, in this scenario, traffic characterisation and monitoring is of paramount relevance to understand users behaviour and prevent possible pitfalls during the deployment of new services.

In order to have an in-depth understanding of the evolution of LTE user plane, we carried out four measurement sessions across three years, from 2013 to 2015. Traffic data has been acquired at one eNodeB of an Italian mobile operator.

The rest of the chapter is organized as follows. Section 2.2 points out the motivations the drove our analysis, focusing on the needs for mobile network operators which try to overcome existing commercial limitations. Sections 2.3 and 2.4 provide a survey on previous researches concerning traffic measurements in mobile networks, while section 2.4 describes the measurement scenario. Section 2.6 provides the main outcomes of this study.

2.2 Lesson Learned: Telecom Italia Testing Lab

The analysis and monitoring of data networks try to shed some light on the huge black box of interconnected computers. In particular, the classification of the network traffic has become crucial for understanding the Internet.

The commercial monitoring systems used during the test are affected by several limi-tations or are very expensive. Many of the solutions available in the market are based on probes able to observe the traffic in the considered network points, and a collector. The collector gathers and elaborates the data acquired by the probes, and generates alarms and data on the network state for the network manager. During the tests some issues derived from the low flexibility given by the commercial solutions. In particular, the key issue is the lack of flexible solutions able to perform repetitive tasks, and to provide relevant performance parameters, taking into account that the concept of relevance is correlated with the particular network scenarios under test. The main manufacturers of network monitoring systems offer flexible and customized solutions at very high costs.

In order to continuously monitor the network under test, it is important to obtain real time information (e.g., counters and alarms), through a seamless dialogue between the probe and the collector. Monitoring is one of the most powerful way to troubleshoot, but often could be quite complicated and tedious. According to 3GPP technical specifications, hundreds of performance and measurements counters can be collected as performance indicators, such as the number of handovers, the number of call drop or the number of RRC connection established. Thus, the complexity of an E-UTRAN system has far surpassed the capability of the operators to manually analyze and diagnose problems. These issues suggest the simplification of O&M functions by means of reconfigurable probes able to

(47)

2.2 Lesson Learned: Telecom Italia Testing Lab 17

collect symptomatic information (the network manager should flexibly decide a priori which counters or messages are relevant).

The test activity pointed out the need for DPI (Deep Packet Inspection) functionality to retrieve specific information from a “target” message, to facilitate the diagnosis of the problem. For instance, DPI does not limit to the observation of an Attach Reject (or some other “bad notice”), but it analyzes the content of this message, e.g. looking at its “Cause” field. This action is important because different causes may trigger different countermeasures. Being able to quickly identify such problems becomes more important in a LTE network, due to high quality of service expectation of end users. Moreover, during test procedures, gathering immediate feedback when a failure happens in the network can help the operators to rapidly adjust misconfiguration, avoiding loss of time.

To cope with these issues, one promising alternative is the development of self-made systems exploiting open-hardware and open-software platforms. Other than a certain reli-ability level, these platforms should be characterised by the extreme flexibility necessary to develop self-made systems with a powerful customisation level at relatively low costs. To this aim, the first step is developing a software library able to process LTE control plane and user plane traffic. Such library leverages on the well-known libpcap either to capture packet on the monitored interface or to offline analyze packet captures. The library has been customized to work on the S1 iterface. It allows to:

• analyse control plane messaging on the S1-MME interface (S1-AP protocol) to identify basic LTE procedure (i.e. attach, RRC connection establishment, handover) and retrieve performance indicator (e.g. latency, signalling overhead)

• analyse user plane traffic with the aim of generating both coarse statistic (i.e. the number of UE under coverage, protocol statistics) and fine grained statistics (i.e. the number of TCP/UDP flows, the maximum inter-arrival packet within each flow) • analyse simultaneously control and user plan to infer network parameters (RRC

Inac-tivity Timer) or associate user acInac-tivity to the correspondent EPS bearer

Explicitly for traffic classification, we designed a tool, called MOSEC. We’ll present this tool in section 2.7.

Beyond the scope of this thesis, we design an integration of our software package with the NetFPGA, to allow line-rate packet processing, high–performance and cost–effective solution to LTE network monitoring lead us to adopt NetFPGA as the basic technological platform to develop our system prototype. The NetFPGA is a low cost development platform designed in the framework of the Clean Slate Project at Stanford University. In its basic version, it comes

(48)

18 Traffic Analysis

equipped with four 1 Gigabit Ethernet that becomes four 10 Gigabit Ethernet ports in its advanced version. In addition, it is equipped with a PCI/PCIe (depending on the version) bus and it allows the hardware/software co-design of advanced networking prototypes/devices. The software part is developed on the hosting PC under Linux OS, while the hardware part is developed by using Xilinx CAD tools (usually Verilog HDL). Preliminary results for our prototype can be found in [45].

2.3 Related Works: Passive Measurement Analysis

Since the beginning of the mobile data era there has been a great interest on the characteriza-tion and measurement of mobile traffic. The different studies in this area can be classified in terminal–based and network–based studies. Terminal–based studies are aimed at characteriz-ing applications and user behavior by acquircharacteriz-ing data on terminals (as examples, see [29] and [53]), whereas the network–based ones attempt to evaluate network performance and usage by measurement sessions carried out through equipment installed in the network. Hence, in this latter case the user has no information about the underlying monitoring process.

Among the terminal-based studies, in [33], the authors report the results of a two-day-long user-based measurement of mobile traffic offloading by over 400 android smartphone users in Japan. They intended to characterize the usage of the 3G and WiFi of smartphones in terms of traffic offloading. On the basis of 255 users of two different smartphone platforms, the authors of [29] characterized users activities and their impact on network and battery. They found immense diversity among users and some statistics reveal differences about one or more order of magnitude. In [53], the authors investigate about diverse usage behaviors of smartphone apps. These studies investigated various aspects such as the diversity of smartphone users and the popularity of mobile applications. The 3G test study presented in [35] adopts another approach by publishing an app that actively measures various network performance metrics on users’ handsets. All these measurements have the drawback that the user’s behavior could be influenced by the knowledge of the presence of the application that monitors its usage of the mobile network services.

The network-based studies solve this biasing problem, in fact the user has no informa-tion about the underlying monitoring process. In [43] the authors conducted a detailed measurement analysis of network resource usage and subscriber behavior by using a large scale data set collected inside a 3G cellular data network. They studied the behavior of mobile subscribers in terms of the traffic they generate, their mobility and their activity, and find a significant variation of network usage among subscribers. Recently, in [34], the authors presented an in–depth study of the interactions among applications, network transport

(49)

2.4 Related Works: Traffic Classification 19

protocol, and the radio layer in the LTE system. They highlighted that LTE has significantly shorter state promotion delays and lower RTTs than those of 3G networks, and pointed out various inefficiencies in TCP over LTE.

2.4 Related Works: Traffic Classification

Finding an efficient method for classifying network traffic using packet layer information is not an easy problem. An exhaustive review on traffic classification techniques is available at [51] and [54]. In general, it is possible to distinguish two main classification algorithms: i) Port and Payload-based algorithms and ii) Behavioural algorithms.

The first one leverages on packet inspection technique to retrieve service related infor-mation. Port-based techniques are widely regarded as the simplest techniques for traffic classification. Nevertheless today traffic monitoring reveals port-based techniques weakness when dealing with peer-to-peer (P2P) applications, which do not use a well-defined port [2]. Some users also configure their programs to use the well-known port for another application to avoid port-based traffic shaping or filtering mechanisms.

Pretty common and useful is to use DNS information to map each IP flow to the cor-respondent domain name. Mellia et al. in [17] propose DN-Hunter, a system that tags network traffic flows with their associated domain name. Their solution comprises a DNS response sniffer that decodes DNS response and, for each response, stores the set of server IPs returned for the fully qualified name (FQDN) queried. To identify the application running on a given port all the FQDNs associated to flows that are directed to that port are tokenized, and most-present tokens are used to tag the targeted port. In our previous work [47] we use a similar approach for labelling network traffic starting from DNS queries and answer. Thus, we apply a string-matching algorithm to bind each flow to a restricted number of service and gather per-service statistic results. Nevertheless, at a given point in time, using stand-alone DNS information may not be sufficient to understand the delivered service. Foremski et al. [31] leverages on the information carried in domain names and port numbers for immediate traffic classification. The weak point of DNS based algorithm is that a lot of popular services as Facebook, Youtube ar Twitter can be served by multiple CDN networks as Google CDN, Amazon Web Services or Akamai. Therefore, if in the FQDN there is no explicit reference to one of the aforementioned application, it is impossible to discern the correct application. In addition, P2P are commonly not tagged by DNS-based mechanism, given that P2P data flows are usually not preceded by DNS resolution, as has been shown in [17].

Traffic classification approaches based on deep packet inspection are considered very accurate, however, two major drawbacks are their invasiveness with respect to users privacy,

Monitoring and testing in LTE networks: from experimental analysis to operational optimisation